UK: “Duty of retrieval” rejected: why banks do not owe a duty to recover funds lost through APP fraud

Fraud is therefore a problem which the law is having increasingly to wrestle with, as more - often very sad - cases come before the English courts with claimants seeking restitution of their lost money. The banks and payment services firms that are involved in the payment process used in these scams are often the targets of the claimants, since the fraudsters are long gone.

This has led to claimants seeking ever more imaginative ways of formulating claims against banks who have handled these transactions to try to pin blame on them, and seek to recover some or all of the sums that have been lost.

The case for a “duty of retrieval”

Most of the cases in respect of payment fraud so far have focused on the idea that the bank should have spotted the fraud in question and stopped the transaction from happening. The typical argument is that “red flags” were present and should have alerted the bank to a problem. Claims have been founded on the so-called “Quincecare” duty (at least insofar as the victim was actually a customer of the bank), which is part of the bank’s duty of reasonable skill and care to its customer and requires the bank to make inquiries to verify that the instruction has been validly authorised by the customer where it is on notice of such “red flags”. Claims have also been founded on the basis that the bank has allegedly incurred liability as an accessory, either by dishonestly assisting another to breach their trust or fiduciary duty to the claimant (“dishonest assistance”) or through receiving the funds in the knowledge that they are received in breach of trust or fiduciary duty (“knowing receipt”).

However, a new argument has begun to emerge in the context of cases in relation to APP fraud involving the so-called “duty of retrieval”. The argument is that, where a fraud has happened and the bank is aware of this, the bank then falls under a duty to act swiftly and promptly to retrieve the proceeds of the fraud and stop the money that has been taken from disappearing into the banking system, potentially overseas, and dissipated by the fraudsters, never to be seen again.

Such a potential duty is said to have been recognised in the leading case of Philipp v Barclays Plc¹ (“Philipp”). Whilst the claimants in that case lost on their primary argument against the bank (that the so-called Quincecare duty could be owed in cases where the customer had specifically authorised the payment as a result of an APP fraud), they ran an alternative argument that, once the bank was on notice that the payment was made in fraudulent circumstances, the bank came under a duty to act promptly to take reasonable steps to retrieve the proceeds of the payment from the bank to whom the payment had been passed.

In relation to this “duty of retrieval”, Lord Leggatt expressed his observations as follows:

“There is no pleaded allegation that on 27 March 2018 Mrs Philipp expressly instructed the Bank to attempt to recall the two earlier payments. But it is arguable that, when she reported that she had been induced to make the payments by fraud, the Bank’s staff should have sought her instructions on this point - which would surely have been given - as it was clear that Mrs Philipp would now wish any available steps to be taken to recover the money. The fact that the Bank made attempts on and after 31 May 2018 to recall the funds which had been transferred to the UAE…indicates that there were steps that could be taken to try to do so and prompts the question of why the Bank did not take those steps sooner. These are not matters that can be resolved at this stage of the proceedings on an application for summary judgment.

The likelihood that, even if prompt action had been taken by the Bank on or immediately after 27 March 2018, any of the money transferred to the UAE would have been successfully reclaimed seems slim. The judge understandably expressed strong doubts about whether there is any realistic basis for Mrs Philipp’s claim that the Bank’s delay caused her to lose a substantial chance of getting any of the money back... Nevertheless, he ultimately concluded that, despite his doubts about the Bank’s ability to recover the payments after 27 March 2018, “there are too many imponderables in this counterfactual scenario for the matter to be decided against Mrs Philipp on paper”: para 182. That was a matter of judgment on which I do not think it would be right for this court to override the view taken by the judge. Although the judge did not himself draw this inference, it seems to me logically to follow from that conclusion that the claim for the loss of a chance of recovering money from the UAE should not have been summarily dismissed”.

These obiter comments must therefore be recognised for what they are. Properly read, they simply demonstrate the Supreme Court’s approval of the view held by the first instance judge², that the case on this point was at least arguable and, had it been necessary for the judge to consider this alternative argument, it could not have been determined on a summary basis (i.e. without further evidence, argument and trial). It was more procedural than substantive. Specifically, it was not an endorsement by the Supreme Court that the argument in fact is correct. Equally, however, given this is a Supreme Court judgment, it is perhaps unsurprising that these words have encouraged claimants who have lost money through APP fraud down a new path.

And, indeed, it is these comments which led to the case of Santander UK Plc v CCP Graduate School Ltd³.

Case facts

In this case, CCP Graduate School Ltd (“CCP”) was the victim of an APP fraud when its director was induced to make 15 payments from its bank account to an account at Santander which, unbeknown to CCP, was controlled by fraudsters. Shortly after receipt into the Santander account, the money was removed by the fraudsters to various other accounts with various other banks, and in turn then paid into accounts with yet further banks.

A few days after the final payment out to Santander, but after substantially all the money had been removed from the Santander account, Santander was contacted by one of the recipient banks who had become suspicious about the movements into and out of its account. Santander at that point put a stop on the account. It also gave indemnities to the recipient bank (i.e. against liability which that bank might incur to its customer when preventing further money from leaving the account). This enabled a small proportion of the lost monies to be recovered.

CCP sued both its own bank (relying on the traditional Quincecare duty), and also sued Santander on the basis that it had an alleged “duty of retrieval” in relation to the sums paid out of the Santander account and that it had allegedly failed to take prompt and effective steps to retrieve those sums.

The case was heard initially by Master Brown in the King’s Bench Division, who dismissed the claim against CCP’s own bank entirely, based on the precedent set by the Supreme Court in Philipp which held that the Quincecare duty did not apply in cases where the customer had unequivocally authorised the bank to make the payment. However, in light of Lord Leggatt’s comments in Philipp (referred to above), Master Brown decided that the case in favour of the existence of a free-standing tort-based “duty of retrieval” was sufficiently arguable that the claim should not in this respect be dismissed or struck out.

Santander appealed, and the case was heard by Mrs Justice Eady in the High Court.

Decision

Eady J reversed the decision made by Master Brown and held that in fact no such freestanding “duty of retrieval” existed as a matter of law in a situation such as this, and the case should therefore be struck out.

She rejected the notion that the Supreme Court in Philipp had recognised the existence of a freestanding “duty of retrieval”, even in the case of a bank’s own customer, let alone a duty owed to third parties. As Eady J made clear, the identification in Philipp of an arguable “duty of retrieval”, owed by a bank to its own customer, arises out of the contractual relationship between the bank and its customer. It is no more than a further facet of the bank’s obligation to properly interpret, ascertain and comply with the customer’s instruction, as part of the bank’s duty to act with reasonable skill and care. This would arguably include seeking the customer’s instructions once notified of a fraud to establish whether steps to attempt retrieval of the customer’s stolen funds should be made. Even then, there is no freestanding duty on the bank to attempt to unwind payment orders previously made on the instructions of the customer: any such attempt could only be undertaken on the specific instructions of the customer, without which the bank would have no authority, let alone obligation, to do so. Eady J held:

“I am unable to read into this part of the judgment in Philipp any basis for holding that there might be a freestanding duty on a bank to take positive steps to unwind harm already caused to a third party (with whom it had no contractual relationship) by attempting to reverse payment orders previously entirely properly made on the instructions of its own customer; indeed such a duty would plainly be in conflict with the observation made by Lord Leggatt…that, absent instructions from its customer, the bank would have “no authority, let alone obligation, to attempt to reverse earlier transactions when to do so would have been directly contrary to its customer’s payment orders”.

Eady J also rejected an argument that it was appropriate to recognise the “duty of retrieval” as a novel duty or incremental development of the law. She approached the analysis using the three “Caparo” factors of foreseeability, proximity and fairness, justice and reasonableness⁴. She also applied the test of asking whether Santander could be regarded as having assumed a responsibility to take care to protect the claimant against loss of the kind claimed, placing weight on the fact that there was no relationship between Santander and CCP such as to give rise to sufficient proximity. She rejected the conclusion of Master Brown that proximity could be established by the special level of control that Santander had over the movement of money in the bank account which it held (for the fraudster): at the time the money was moved from the Santander account, Santander’s only obligation was to obey the instructions of its own customer. Imposing such a duty would also not be fair, just or reasonable. She further rejected Master Brown’s reliance on the fact that banks operated a system of voluntary indemnities as being a basis for imposing such a duty, stating: “the fact that banks are willing to take steps to assist victims does not mean that the courts should find they have a legal obligation to do so”.

Eady J also relied on the practical implications for banks should such a freestanding “duty of retrieval” exist. In that event, upon a fraud alert from a stranger in relation to an account held by one of its customers, the bank would have to contact all other banks into which monies from the account have been transferred and, contrary to the instructions of its customer, seek an immediate recall of those sums or otherwise prevent further movement of those monies. The bank would be in an impossible position firstly of having to make a speedy adjudication upon the allegation of fraud made by the third party against its own customer. Even if it does that, secondly, it would then have an unacceptable burden to chase down numerous transactions through multiple banks, potentially overseas, which will have happened at speed and largely in an automated way through the banking system. In practice, the duty is unworkable.

Finally, as was identified in Philipp, the relevant regulatory context is significant. The judge identified the fact that the Payment Services Regulations 2017 (“PSRs”) make provisions to ensure the speedy and unhindered execution of payments covered by these regulations provided they are executed in accordance with their unique identifier: the proposed “duty of retrieval” would appear to undercut such certainty. Further, the APP mandatory reimbursement scheme mandated by the Financial Services and Markets Act 2023 and introduced by the Payment Systems Regulator provides reimbursement to victims of APP fraud up to a maximum of £85,000. This is the balance that has been struck as a matter of social policy by regulators, government and Parliament, and it is not therefore appropriate for the courts to interfere with that balance.

Commentary

This decision to reject the proposed freestanding “duty of retrieval” appears to be correct when read against the backdrop of the approach adopted by the Supreme Court in Philipp. Whether, in fact, any such duty exists at all, even as an adjunct to the contractual duties owed by banks, remains unclear. However, we can say some things with certainty.

1. First, any such duty as exists only exists from the point at which the bank is notified unequivocally by its customer that their previous payment instructions have been revoked and their instructions are now to recover such monies as they are able to. Before that point, the court was clear to recognise that the bank remains bound by the previous customer instructions. This remains true even if the bank suspects, or even has knowledge, that such instructions may have been induced by fraud (as happened in Philipp where the bank had been tipped off about the fraud, but the customer refused to heed the bank’s warnings): the bank remains bound by the customer’s instructions until the point they are explicitly revoked, and fresh instructions are given.
2. Second, no “duty of retrieval” applies down the chain of payments. Eady J’s judgment in CCP makes clear, as seems to be obvious on application of the principles laid down by Philipp, that the “duty of retrieval” is, at best, an adjunct to the immediate banker/customer relationship. There is no separate, freestanding duty of care owed to the original payer of the monies by recipient banks down the chain to try to retrieve monies that have been paid out. Eady J very clearly recognised the equivalent duties that receiving banks are under to pay out monies in accordance with their own customer’s instructions, and therefore no fault was placed on any receiving bank who paid money out in these circumstances. Of course, if the receiving bank still has the funds in its custody, and suspects they may be the proceeds of crime, then the Proceeds of Crime Act 2002 will require the bank not to deal with the proceeds further, and to file a suspicious activity report with the National Crime Agency.
3. Third, as described in the judgment, banks do, in practice, operate a voluntary system of inter-bank indemnities to try to counter fraud of this kind and mitigate the effect of these very strict legal duties, and so halt the flow of fraudulently obtained proceeds of crime, and indeed to mitigate the very strict rules that the law places on banks to operate accounts in accordance with their customer mandates. However, in this case, the claimant sought to use the availability of these potential tools to support a case that the receiving bank could, and should, have done more. The court has very helpfully rejected this argument. The fact that banks go above and beyond what is strictly legally required to help detect and prevent fraud and recover its proceeds should not be weaponised against banks as the basis on which to assert legal duties.
4. Fourth, as noted above, but bears repeating, the Supreme Court in Philipp did not “recognise” the existence of a “duty of retrieval”: it merely agreed with the first instance judge that the argument in favour of such a duty existing could not be determined on a summary basis but should be argued at full trial. The existence of such a duty is therefore still uncertain. Further, most other aspects of such a cause of action are also unclear. For example, it is uncertain what exactly could, or should, be done by a bank to fulfil such a duty, although inevitably this will be highly fact-specific in each case. The consequence of breach of such a duty is also unclear but also likely to be highly fact-specific in each case. In most, if not all cases, breach will result in a “loss of a chance” for the customer to make a recovery by retrieving lost money: in most cases that chance will be low to non-existent since proceeds of the fraud will be very quickly gone, and therefore will be, at best, speculative. It is also unclear to what extent the bank could rely on contributory negligence by the customer, both at the point at which the initial payment away is made, and in relation to any further delay in revoking the initial instructions (as happened in Philipp) thus making retrieval harder, or impossible, and reducing any likely recovery by the customer pursuant to the duty significantly.
5. Fifth, reference always needs to be made back to the underlying statutory and regulatory scheme that applies in cases such as this. This is touched on briefly in both Philipp and CCP. However in cases where the PSRs apply, provision is already made in respect of a number of the relevant issues. In such cases the general rule is that a payment instruction is irrevocable once received by the bank or paying entity (reg 83) and the bank or paying entity is entitled to rely on the unique identifier provided by the customer (reg 90). In the case of wrong details being provided by the customer, such as a wrong sort code or account number, the PSRs only require a bank to use reasonable steps to make recovery for the customer, and the bank is not liable to the customer for the misdirected payment (reg 90). However, where the payment order was executed on or after 7 October 2024 subsequent to fraud or dishonesty, and the resulting payment is a domestic UK payment made using the Faster Payments or CHAPS systems, the APP mandatory reimbursement scheme will now apply. In such cases, the payer may be reimbursed for their loss up to £85,000 through the scheme, with liability for the customer’s loss split 50/50 between paying and receiving bank. In cases where the facts pre-date the scheme (such as Philipp and CCP), or which involve payments made using other UK payment systems, or international payments, or where losses exceed £85,000, the scheme will of course not assist, and fraud victims are left with their rights under the general law. As from 30 October 2024, in order to give the paying entity the flexibility to prevent APP fraud more effectively, it can delay payments by up to four business days for the purpose of investigating transactions where it has reasonable grounds to suspect fraud or dishonesty on the part of someone other than the payer⁵. Given this intense level of legislative and regulatory overlay, which prioritises the smooth (and highly automated) process for payment execution, it seems highly unlikely that the courts will be willing in future cases to intervene in any significant way, if at all, to disturb the approach that Parliament has laid down.

Thus, while this judgment will be of comfort to banks and gives certainty as to the nature of their duties, it does close down one more route of recovery for the unfortunate victims of such frauds to recover their losses.

If you have any questions about this article, or any of the issues raised, please get in touch with one of the contacts listed, or your usual contact at Hogan Lovells.

Authored by Philip Parish and Daniela Vella.